TECHNICAL LEAD - SOAR Concept

Job description

Security Orchestration and Automation As part of this profile, the resource will perform the following: Platform Management and Administration • Manage, administer, and support the SOAR platform (preferable CrowdStrike Falcon Fusion SOAR, Including • Master Console • SOAR SME • SOAR Agents • Platform updates, configuration management, and issue resolution Connector and Integration Management • Monitor, troubleshoot, and resolve issues with SOAR connectors and system integrations. • Ensure seamless and continuous data exchange between SOAR and all integrated security solutions (e.g., SIEM, EDR, firewall, threat intel, ticketing). Backup and Configuration Management • Perform monthly backups of SOAR: • Playbooks • Configuration data • System settings and alerts • Agent and SME nodes Vendor Coordination • Act as the primary point of contact with Fortinet for: • Issue escalation and troubleshooting • Platform patches and upgrades • Enhancement requests and license tracking • Track and close vendor support tickets in accordance with SLA timelines. Platform Health and Optimization • Conduct quarterly health checks to assess: • System performance and load handling • Integration health and response accuracy • Use case effectiveness • Recommend and implement enhancements to improve operational efficiency and incident response timelines. Access Management and Governance • Manage user roles, permissions, and platform access control. • Conduct quarterly access reviews to ensure RBAC enforcement and privilege hygiene. SOP Documentation and Knowledge Base • Document, maintain, and regularly update: • Standard Operating Procedures (SOPs) • Playbook logic flows • Integration procedures and manual override guidelines Performance Reporting • Provide periodic performance reports including: • Playbook execution metrics • Manual vs. automated response ratios • Integration status • SOC efficiency improvements via automation Integration with Security Ecosystem • Integrate SOAR with: • SIEM platforms • Threat intelligence sources • Incident ticketing tools • Identity and access management platforms • Maintain alignment with MAF?s overall security architecture. Incident Response Support and Manual Decisioning • Support manual approval/denial workflows within playbooks (e.g., approval to block IOCs, isolate assets, trigger escalations). • Ensure proper documentation and SLA adherence for manual interventions. Playbook Development and Expansion • Create, update, and maintain playbooks to: • Automate routine tasks (e.g., IOC enrichment, phishing triage) • Enhance response accuracy and consistency • Reduce mean time to respond (MTTR) • Bidders must demonstrate their capability to expand SOAR use cases to drive operational maturity and incident handling speed. New Connector Development • Develop and deploy new connectors as needed to support integration with: • New applications • Infrastructure services • Cloud and third-party APIs • Ensure connectors are tested, documented, and production ready. Business Continuity and Disaster Recovery • Develop, maintain, and test BC/DR plans for SOAR platform components, agents, and database. • Validate system recovery processes and resilience against platform failure. SOAR Concept